One in four government organizations suffers accidental cloud leakage
Detecting and resolving data leakage is a top security challenge for public sector organizations with 24 percent suffering accidental leakage of cloud data.
The 2021 Cloud Data Security Report from Netwrix finds phishing (reported by 39 percent of organizations) to be the most common incident that government agencies experienced in the cloud, followed by accidental data leakage (24 percent) and targeted attacks on infrastructure (22 percent).
Privileged access is the Achilles heel of enterprise security
Failure to automate control of physical accounts is a major weak point in enterprise security according to a study released by Thycotic.
Among the findings are that a significant number of enterprises (28 percent) only audit privileged access management (PAM) on a quarterly or annual basis.
New SaaS solution uses machine learning to detect cyber threats
Cybersecurity and risk management company RSA is launching Detect AI, a cloud-native advanced analytics and machine learning solution that provides rapid detection and actionable insights on data captured by the RSA NetWitness Platform.
It employs cloud-scale processing for behavior analytics and uses unsupervised machine-learning to allow it to detect and respond to threats without manual oversight.
ICS vulnerabilities increase as remote work boosts attack surface
Disclosed vulnerabilities in industrial control systems (ICS) increased 335 percent in the second half of 2020 compared to the first half.
A new report from Claroty also shows that in the same period 71 percent of ICS vulnerabilities disclosed were remotely exploitable through network attack vectors.
Linux sudo vulnerability also affects macOS
We recently wrote about a serious vulnerability in the sudo tool which could be used to gain root access to Linux systems. Now a security researcher has found that the security flaw also affects macOS Big Sur -- including on new M1 Macs.
The Baron Samedit vulnerability -- or CVE-2021-3156 -- is a heap-based buffer overflow bug that was discovered by cybersecurity firm Qualys. While it was initially thought to only affect Linux systems, researcher Matthew Hickey (who also goes by the name Hacker Fantastic) found that macOS is also vulnerable with only very minor changes needed to the original exploit.
CISO role expands in a changing business world
A new survey of the opinions of more than 7000 business leaders, employees and consumers from across the world shows the role of CISO has hugely expanded in its scope and responsibilities.
However, the study from BT Security also shows that fewer than half of executives and employees could put a name to their CISO. This is despite the fact that 84 percent of executives also say that their organization had suffered from data loss or a security incident in the last two years.
Outdated online security is losing banks business
New research from biometric authentication company iProov highlights that many US banks are falling short in delivering digital convenience to their customers.
The study looks at the range and usability of online services being offered to existing customers. Researchers looked at 39 data points, including how easy it was for a customer to move money, request a new debit card or change personal details online.
API security worries hold back business innovation
A new report shows that 66 percent of organizations admit slowing the rollout of a new application into production because of API security concerns.
The State of API Security report from Salt Security also reveals that 54 percent of organizations running production APIs have at best only a basic strategy for API security, with 27 percent having no strategy at all.
Remote working adds to threats but security stays strong
The pandemic-driven switch to remote working has brought more threats, but overall cybersecurity posture has remained strong, according to a new report.
The study from security orchestration, automation and response company Siemplify attributes this to greater investment in security automation technologies and reliance on managed security service providers.
Over 60 percent of DevOps teams would sacrifice container security for speed
A new survey of container security from NeuVector shows that 63 percent of respondents would curtail or restrain security measures in order to maintain faster production.
There's also a lack of consensus on who is responsible for securing container environments with 42 percent saying security teams, 30 percent development, and 28 percent operations. This is despite 32 percent saying security is their organization's single most important priority as they roll out containers and Kubernetes initiatives.
Ubuntu Core 20 offers secure Linux for IoT devices
Canonical is making Ubuntu Core 20, a minimal, containerized version of Ubuntu 20.04 LTS for IoT devices and embedded systems, generally available from today.
It improves device security with secure boot, full disk encryption, and secure device recovery and builds on the Ubuntu application ecosystem in order to create ultra-secure smart things.
Linux malware Kobalos steals credentials using hacked OpenSSH software
A trojanized version of OpenSSH software is being used to steal SSH credentials from high performance computing (HPC) clusters, reports security firm ESET. The Linux malware has been dubbed Kobalos, and is described as "small, yet complex" and "tricksy".
Despite its diminutive size, the Kobalos backdoor is hitting some major targets including government systems in the US, universities in Europe, and a major ISP in Asia. Security experts report that while the multiplatform backdoor works on Linux, FreeBSD and Solaris, "there are also artifacts indicating that variants of this malware may exist for AIX and even Windows".
One Identity launches SaaS-based access management solution
The shift to more remote work has boosted companies 'move to cloud' options and that has shone a spotlight on the need for identity governance and administration (IGA) and privileged access management (PAM) solutions.
Identity-centric security firm One Identity is launching a new software-as-a-service identity platform that offers full IGA and PAM capabilities and allows organizations to implement a zero trust model.
Poor remote endpoint visibility puts organizations at risk
Most organizations have a severe lack of visibility into remote endpoints according to a new report, which poses additional risks as more people work from home.
In addition, few have a way to stop ransomware from spreading throughout their network after an initial breach, according to the study from zero trust specialist Illumio.
International law enforcement effort takes down Emotet from the inside
Law enforcement authorities in the Netherlands, Germany, the US, the UK, France, Lithuania, Canada and Ukraine have collaborated to disrupt Emotet, one of the most significant botnets of the past decade.
The effort, coordinated by Europol the joint European policing agency, gained control of the Emotet infrastructure and took it down from the inside. Infected machines of victims have been redirected towards this law enforcement-controlled infrastructure.
Recent Headlines
BetaNews, your source for breaking tech news, reviews, and in-depth reporting since 1998.
© 1998-2025 BetaNews, Inc. All Rights Reserved. About Us - Privacy Policy - Cookie Policy - Sitemap.